I read the article and noticed that they claim it could also be used to move from ring 3 to SMM. Did anyone quite get how that was working? I see how to move from ring 0 to SMM using this exploit. Still a major feat, but I'm missing how an unprivileged user is able to exploit this as they need to alter one of the MSR's. Even in Linux, only root has access to write to these.

I've read it twice and understand Intel architecture pretty well but I can't see how this exploit can be used (by itself) by a non-privileged user on any OS I'm familiar with to dump SMRAM.

I finally made it through the article and the one referenced from Blackhat 2008. While I do not fully understand Intel architecture, it seems like this is quite real, but not as scary as it sounded. You would have to do quite a bit of recon and then write some simplistic drivers and interfaces for each function of your rootkit, such as keyboard trapping and network I/O. Like the papers state, this makes it a very targeted attack at this point. Looks like Intel is slowly but surely patching these vulnerabilities. I am guessing that if they completely drop the ball here, you are going to see people writing some automated tools to exploit these.

Former33t, you would have to escalate privs from ring 3 in order to gain access to the SMM RAM areas. There are a number of exploits in Windows and Nix that some can take advantage of for this purpose.

As I understood it, BIOS and Chipset manufacturers have to get together and stop allowing access to the SMRAM area of RAM from the OS. Although, if I understood it correctly, one of the exploits dealt with the area of RAM where VGA memory and SMRAM memory crossed over.